I just tried to run KnowBe4 Ran Sim.
SAC blocked first, with an explanation.(probably geneic explanation, I haven't seen one before)
So I disabled SAC and test again.
Now Kaspsesky blocked it, with a access denied message, and nothing in detection log.
Then CyberLock popped up an allow or not dialog.
My aim is the test Kaspersky's process injection mitigation, and the plan failed. K blocks the installatiion probably with signature - the installation doesn't even begin. And it shows no explanation. The KnowBe4 Ran Sim is supposed to use several process injection methods.
What you’re seeing is fairly typical when you run “simulator” tools: Windows and AV products often block them early (reputation/signature/risk-tool classification) before any “process injection mitigation” behavior can be observed, so the test never reaches the stages you actually want to evaluate.
Why SAC blocked it first
Smart App Control (SAC) mainly gates execution based on reputation/signing and cloud judgments. Tools like RanSim are commonly low-reputation and behave like malware (by design), so SAC may stop them even if they’re legitimate.
Why Kaspersky can deny access with no obvious detection entry
Kaspersky can block in multiple layers, and not all of them show up as a classic “malware detection” entry:
- Application Control / Default Deny / Restrictions can block a process start and show “Access denied” without a typical signature detection name.
- Intrusion Prevention or Exploit/behavior rules may terminate/deny actions and log under a different component than “Detections”.
- System Watcher / ransomware protection behavior can also stop RanSim very early because it intentionally performs ransomware-like actions.
So the key point is: “nothing in detection log” doesn’t necessarily mean “no record”; it often means “it’s recorded under another report category.”
What to check inside Kaspersky (most useful first)
Without knowing your exact Kaspersky product/UI version, these are the usual places where the event is recorded:
- Reports / Event log and then filter by components such as:
- Application Control
- System Watcher
- Intrusion Prevention
- File Anti-Virus
- Quarantine (in case it was deleted/disinfected instantly)
- Excluded/Trusted zone events (if it was auto-handled due to policy)
If you want to share a screenshot of the “Access denied” popup and your Kaspersky version (Standard/Plus/Premium vs KIS/KES), members can usually point to the exact component that did it.
Testing process injection mitigation safely (so the test actually runs)
If your goal is specifically to observe injection-related blocking rather than signature/reputation blocking, the practical approach is:
- Do it in a VM (snapshot first), offline or on an isolated network. RanSim-style tools can still cause real disruption if something goes wrong.
- Verify you downloaded the official RanSim (don’t rely on random mirrors). You can also submit the installer hash/file to VirusTotal for visibility. This won’t prove it’s safe, but it helps confirm you’re testing the expected file.
- Temporarily create an explicit allow/exclusion for the RanSim installer and folder (only in the VM). Otherwise, Kaspersky may block at “on-access scan” before any injection attempt happens.
- Enable/keep detailed reporting in Kaspersky so you can see which module blocks which action.
Important limitation: even with exclusions, some products still block “risk-tool / simulator” behavior via behavior rules. In that case, RanSim is simply not a good tool to isolate “process injection mitigation,” because it triggers other high-priority defenses first.
CyberLock prompt
That part makes sense: whitelisting/anti-execution tools commonly prompt rather than silently block. It also reinforces that RanSim is behaving like a threat simulator (again: expected), so layered defenses will interfere unless you carve out a controlled test policy.
Bottom line
Your plan didn’t fail because Kaspersky “has no injection mitigation,” but because RanSim is getting stopped at earlier layers (reputation/signature/application control/behavior) that prevent the injection stage from running. The next productive step is running it in an isolated VM and checking Kaspersky’s component-specific reports (especially Application Control/System Watcher/Intrusion Prevention), then only if needed using a VM-only allow/exclusion so the tool can reach the injection techniques you’re trying to evaluate.
